Sign-up

ID

VAR-202201-0652


CVE

CVE-2021-40413


TITLE

reolink RLC-410W  Vulnerability regarding improper default permissions in

Trust: 0.8

sources: JVNDB: JVNDB-2021-018219

DESCRIPTION

An incorrect default permission vulnerability exists in the cgiserver.cgi cgi_check_ability functionality of reolink RLC-410W v3.0.0.136_20121102. The UpgradePrepare is the API that checks if a provided filename identifies a new version of the RLC-410W firmware. If the version is new, it would be possible, allegedly, to later on perform the Upgrade. An attacker can send an HTTP request to trigger this vulnerability. reolink RLC-410W There is a vulnerability in improper default permissions.Information is tampered with and service operation is interrupted (DoS) It may be in a state. Reolink Rlc-410W is a Wifi security camera from China Reolink company

Trust: 2.16

sources: NVD: CVE-2021-40413 // JVNDB: JVNDB-2021-018219 // CNVD: CNVD-2022-10724

IOT TAXONOMY

category:['IoT']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-10724

AFFECTED PRODUCTS

vendor:reolinkmodel:rlc-410wscope:eqversion:3.0.0.136_20121102

Trust: 1.0

vendor:reolink digitalmodel:rlc-410wscope:eqversion:rlc-410w firmware 3.0.0.136_20121102

Trust: 0.8

vendor:reolink digitalmodel:rlc-410wscope:eqversion: -

Trust: 0.8

vendor:reolinkmodel:rlc-410w 3.0.0.136 20121102scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2022-10724 // JVNDB: JVNDB-2021-018219 // NVD: CVE-2021-40413

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-40413
value: HIGH

Trust: 1.0

talos-cna@cisco.com: CVE-2021-40413
value: HIGH

Trust: 1.0

NVD: CVE-2021-40413
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-10724
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202201-2360
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2021-40413
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2022-10724
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

talos-cna@cisco.com: CVE-2021-40413
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 4.2
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2021-40413
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 4.2
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2022-10724 // JVNDB: JVNDB-2021-018219 // CNNVD: CNNVD-202201-2360 // NVD: CVE-2021-40413 // NVD: CVE-2021-40413

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.0

problemtype:CWE-276

Trust: 1.0

problemtype:Inappropriate default permissions (CWE-276) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2021-018219 // NVD: CVE-2021-40413

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-2360

TYPE

access control error

Trust: 0.6

sources: CNNVD: CNNVD-202201-2360

PATCH

title:Top Pageurl:https://reolink.com/

Trust: 0.8

title:Patch for Reolink RLC-410W Access Control Error Vulnerability (CNVD-2022-10724)url:https://www.cnvd.org.cn/patchInfo/show/319321

Trust: 0.6

title:Reolink Rlc-410W Fixes for access control error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=180350

Trust: 0.6

sources: CNVD: CNVD-2022-10724 // JVNDB: JVNDB-2021-018219 // CNNVD: CNNVD-202201-2360

EXTERNAL IDS

db:NVDid:CVE-2021-40413

Trust: 3.8

db:TALOSid:TALOS-2021-1425

Trust: 2.4

db:JVNDBid:JVNDB-2021-018219

Trust: 0.8

db:CNVDid:CNVD-2022-10724

Trust: 0.6

db:CS-HELPid:SB2022012706

Trust: 0.6

db:CNNVDid:CNNVD-202201-2360

Trust: 0.6

sources: CNVD: CNVD-2022-10724 // JVNDB: JVNDB-2021-018219 // CNNVD: CNNVD-202201-2360 // NVD: CVE-2021-40413

REFERENCES

url:https://talosintelligence.com/vulnerability_reports/talos-2021-1425

Trust: 3.0

url:https://nvd.nist.gov/vuln/detail/cve-2021-40413

Trust: 2.0

url:https://www.cybersecurity-help.cz/vdb/sb2022012706

Trust: 0.6

sources: CNVD: CNVD-2022-10724 // JVNDB: JVNDB-2021-018219 // CNNVD: CNNVD-202201-2360 // NVD: CVE-2021-40413

CREDITS

Discovered by Francesco Benvenuto of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-202201-2360

SOURCES

db:CNVDid:CNVD-2022-10724
db:JVNDBid:JVNDB-2021-018219
db:CNNVDid:CNNVD-202201-2360
db:NVDid:CVE-2021-40413

LAST UPDATE DATE

2024-11-23T21:33:21.667000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-10724date:2022-02-16T00:00:00
db:JVNDBid:JVNDB-2021-018219date:2023-04-18T05:10:00
db:CNNVDid:CNNVD-202201-2360date:2022-06-16T00:00:00
db:NVDid:CVE-2021-40413date:2024-11-21T06:24:04.970

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-10724date:2022-02-16T00:00:00
db:JVNDBid:JVNDB-2021-018219date:2023-04-18T00:00:00
db:CNNVDid:CNNVD-202201-2360date:2022-01-26T00:00:00
db:NVDid:CVE-2021-40413date:2022-01-28T20:15:11.870